Active Directory Pro
Book a demo Free Trial

Connect Microsoft 365 Tenant

AD Pro Toolkit connects to Microsoft 365 using an app registration you create in your own Entra ID (Azure AD) tenant. The app uses application permissions to create cloud users and assign licenses on your behalf. You stay in control: you grant the permissions, you create the secret, and you can revoke access at any time.

This takes about five minutes. You will need an account with the Global Administrator or Privileged Role Administrator role to grant admin consent.

What you will end up with

Three values to paste into AD Pro Toolkit (Settings > Connections > Microsoft 365):

  • Directory (tenant) ID
  • Application (client) ID
  • Client secret value

Step 1: Register the application

  1. Sign in to the Microsoft Entra admin center.
  2. Go to Identity > Applications > App registrations.
  3. Select New registration.
  4. Enter a name, for example AD Pro Toolkit.
  5. Under Supported account types, choose Single tenant only.
  6. Leave Redirect URI empty. It is not needed for creating users and managing licenses.
  7. Select Register.

On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. You will need both later.

Step 2: Add the API permissions

  1. In the app, go to API permissions.

  2. Select Add a permission, then Microsoft Graph.

  3. Choose Application permissions (not Delegated).

  4. Add the following permissions:

    Permission Why it is needed
    User.ReadWrite.All Create and manage cloud users, and assign licenses
    Organization.Read.All Read available licenses, verified domains, and tenant country

  5. Select Add permissions.

Application permissions do not take effect until an administrator consents to them.

  1. Still on the API permissions page, select Grant admin consent for [your organization].
  2. Confirm. Each permission's Status should change to a green Granted for [your organization].

If the button is greyed out, sign in with an account that has the Global Administrator or Privileged Role Administrator role.

Step 4: Create a client secret

  1. Go to Certificates & secrets > Client secrets.
  2. Select New client secret.
  3. Enter a description, for example AD Pro Toolkit, and choose an expiry. A longer expiry means fewer renewals; a shorter one is more secure. 12 or 24 months is common.
  4. Select Add.
  5. Copy the secret Value immediately. It is shown only once. If you navigate away before copying it, delete the secret and create a new one.

Copy the Value, not the Secret ID. The Value is the long string you paste into the app; the Secret ID is just an internal reference and will not work.

Step 5: Connect AD Pro Toolkit

  1. In AD Pro Toolkit, go to Settings > Connections > Microsoft 365.
  2. Select Connect a tenant.
  3. Enter:
    • Connection Name: a friendly label, for example Production Tenant.
    • Tenant ID: the Directory (tenant) ID from Step 1.
    • Application (Client) ID: the Application (client) ID from Step 1.
    • Client Secret: the secret Value from Step 4.
    • Cloud: Commercial for worldwide and GCC, or GCC High / DoD for US Government clouds.
  4. Select Add Connection. The app validates the credentials before saving. A successful test confirms the tenant is connected and ready.

The client secret is stored encrypted on the server and is never shown again.

Renewing the secret before it expires

Client secrets expire on the date you set in Step 4. Before then:

  1. Create a new client secret (Step 4) and copy its Value.
  2. In AD Pro Toolkit, edit the connection and paste the new secret, then save.
  3. Once the new secret works, you can delete the old one in Entra.

Troubleshooting

  • "Invalid client secret": you likely copied the Secret ID instead of the Value, or the secret has expired. Create a new secret and use its Value.
  • "Insufficient privileges" when creating users: admin consent was not granted. Return to Step 3.
  • "The domain portion of the userPrincipalName is invalid": the UPN suffix you are creating the user with is not a verified domain in the tenant. Verify the domain in Entra, or create the user with a verified suffix.